diff options
Diffstat (limited to 'mod/blog/actions')
| -rw-r--r-- | mod/blog/actions/blog/auto_save_revision.php | 2 | ||||
| -rw-r--r-- | mod/blog/actions/blog/save.php | 10 |
2 files changed, 8 insertions, 4 deletions
diff --git a/mod/blog/actions/blog/auto_save_revision.php b/mod/blog/actions/blog/auto_save_revision.php index 66b65c5fd..e33edfaab 100644 --- a/mod/blog/actions/blog/auto_save_revision.php +++ b/mod/blog/actions/blog/auto_save_revision.php @@ -7,7 +7,7 @@ $guid = get_input('guid'); $user = elgg_get_logged_in_user_entity(); -$title = get_input('title'); +$title = htmlspecialchars(get_input('title', '', false), ENT_QUOTES, 'UTF-8'); $description = get_input('description'); $excerpt = get_input('excerpt'); diff --git a/mod/blog/actions/blog/save.php b/mod/blog/actions/blog/save.php index 8923cd0d2..070c96398 100644 --- a/mod/blog/actions/blog/save.php +++ b/mod/blog/actions/blog/save.php @@ -57,7 +57,11 @@ $required = array('title', 'description'); // load from POST and do sanity and access checking foreach ($values as $name => $default) { - $value = get_input($name, $default); + if ($name === 'title') { + $value = htmlspecialchars(get_input('title', $default, false), ENT_QUOTES, 'UTF-8'); + } else { + $value = get_input($name, $default); + } if (in_array($name, $required) && empty($value)) { $error = elgg_echo("blog:error:missing:$name"); @@ -145,7 +149,7 @@ if (!$error) { // add to river if changing status or published, regardless of new post // because we remove it for drafts. if (($new_post || $old_status == 'draft') && $status == 'published') { - add_to_river('river/object/blog/create', 'create', elgg_get_logged_in_user_guid(), $blog->getGUID()); + add_to_river('river/object/blog/create', 'create', $blog->owner_guid, $blog->getGUID()); if ($guid) { $blog->time_created = time(); @@ -170,4 +174,4 @@ if (!$error) { } else { register_error($error); forward($error_forward_url); -}
\ No newline at end of file +} |